t-mobile[.]ptgkbv[.]top

This domain, t-mobile.ptgkbv.top, is actively engaged in a brand impersonation phishing campaign targeting T-Mobile customers. Analysis indicates the site presents a fraudulent login interface designed to harvest user credentials, including usernames, passwords, and potentially multi-factor authentication codes. The domain mimics legitimate T-Mobile branding to deceive visitors into entering sensitive account information, which threat actors can then exploit for unauthorized access, account takeovers, or further social engineering attacks. Infrastructure analysis reveals the domain was registered on May 29, 2026, through NameSilo, LLC, a registrar frequently associated with malicious activity. It resolves to the IP address 188.114.97.3, hosted on AS13335 (Cloudflare, Inc.), a network commonly leveraged to obfuscate phishing infrastructure. Detection metrics confirm the domain is flagged by 21 out of 95 security vendors on VirusTotal, while Google Safe Browsing classifies it as a phishing threat. Additionally, the domain appears on one security blocklist, and no valid SSL certificate is present, further indicating its malicious nature. The page title, 'Welcome to OpenResty!', suggests the use of a misconfigured or intentionally exposed server framework, a tactic observed in hastily deployed phishing kits. Users who have visited t-mobile.ptgkbv.top or entered credentials on the site should immediately take corrective action. All exposed passwords must be changed, not only for T-Mobile accounts but also for any other services where the same credentials were reused. Affected individuals are advised to enable multi-factor authentication on all critical accounts and monitor for unauthorized transactions or login attempts. If financial or personally identifiable information was submitted, users should consider placing a fraud alert on their credit files. Organizations should update their web filtering rules to block this domain and its associated IP address to prevent further exposure.